Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

7492 vulnerabilities reference this CWE, most recent first.

CVE-2026-110453 (GCVE-0-2026-110453)

Vulnerability from cvelistv5 – Published: 2026-10-14 04:15 – Updated: 2026-10-14 04:15
VLAI
Summary
Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
Severity
4.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CWE
  • CWE-863 - Incorrect Authorization
Assigner
mitre CNA under the mitre root
CNA scorecard E 28/100 over 2347 records in the last 180 days details
References
Impacted products
Vendor Product Version
NixOS Nix Affected: 0 , < 2.28.8 (semver)
Affected: 2.29.0 , < 2.30.6 (semver)
Affected: 2.31.0 , < 2.31.6 (semver)
Affected: 2.32.0 , < 2.34.9 (semver)
Affected: 2.35.0 , < 2.35.3 (semver)
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Nix",
          "vendor": "NixOS",
          "versions": [
            {
              "lessThan": "2.28.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.30.6",
              "status": "affected",
              "version": "2.29.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.31.6",
              "status": "affected",
              "version": "2.31.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.34.9",
              "status": "affected",
              "version": "2.32.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.35.3",
              "status": "affected",
              "version": "2.35.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.28.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.30.6",
                  "versionStartIncluding": "2.29.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.31.6",
                  "versionStartIncluding": "2.31.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.34.9",
                  "versionStartIncluding": "2.32.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.35.3",
                  "versionStartIncluding": "2.35.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T04:15:47.269Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-110453",
    "datePublished": "2026-10-14T04:15:47.269Z",
    "dateReserved": "2026-10-14T04:15:46.477Z",
    "dateUpdated": "2026-10-14T04:15:47.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110451 (GCVE-0-2026-110451)

Vulnerability from cvelistv5 – Published: 2026-10-14 04:08 – Updated: 2026-10-14 14:54
VLAI
Summary
Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
Severity
4.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:54 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
mitre CNA under the mitre root
CNA scorecard E 28/100 over 2347 records in the last 180 days details
References
Impacted products
Vendor Product Version
NixOS Nix Affected: 0 , < 2.28.8 (semver)
Affected: 2.29.0 , < 2.30.6 (semver)
Affected: 2.31.0 , < 2.31.6 (semver)
Affected: 2.32.0 , < 2.34.9 (semver)
Affected: 2.35.0 , < 2.35.3 (semver)
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
    cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T14:54:20.682665Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T14:54:42.999Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Nix",
          "vendor": "NixOS",
          "versions": [
            {
              "lessThan": "2.28.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.30.6",
              "status": "affected",
              "version": "2.29.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.31.6",
              "status": "affected",
              "version": "2.31.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.34.9",
              "status": "affected",
              "version": "2.32.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.35.3",
              "status": "affected",
              "version": "2.35.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.28.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.30.6",
                  "versionStartIncluding": "2.29.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.31.6",
                  "versionStartIncluding": "2.31.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.34.9",
                  "versionStartIncluding": "2.32.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.35.3",
                  "versionStartIncluding": "2.35.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T04:08:10.471Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-110451",
    "datePublished": "2026-10-14T04:08:10.471Z",
    "dateReserved": "2026-10-14T04:08:09.697Z",
    "dateUpdated": "2026-10-14T14:54:42.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110287 (GCVE-0-2026-110287)

Vulnerability from cvelistv5 – Published: 2026-10-16 13:43 – Updated: 2026-10-16 15:10
VLAI
Summary
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:10 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
DEVOLUTIONS CNA under the mitre root
CNA scorecard E 44/100 over 64 records in the last 180 days details
References
Impacted products
Vendor Product Version
Devolutions Server Affected: 0 , < 2026.3.10 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-110287",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:10:03.798886Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:10:08.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Devolutions",
          "versions": [
            {
              "lessThan": "2026.3.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint."
            }
          ],
          "value": "Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T13:43:25.516Z",
        "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
        "shortName": "DEVOLUTIONS"
      },
      "references": [
        {
          "url": "https://devolutions.net/security/advisories/DEVO-2026-0036/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
    "assignerShortName": "DEVOLUTIONS",
    "cveId": "CVE-2026-110287",
    "datePublished": "2026-10-16T13:43:25.516Z",
    "dateReserved": "2026-10-13T19:35:53.329Z",
    "dateUpdated": "2026-10-16T15:10:08.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110112 (GCVE-0-2026-110112)

Vulnerability from cvelistv5 – Published: 2026-10-13 19:05 – Updated: 2026-10-17 00:40
VLAI
Title
Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
Summary
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.
Severity
9.2 (Critical)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-17 00:40 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6476 records in the last 180 days details
References
Impacted products
Vendor Product Version
Finsys dockhand Affected: 0 , < 1.0.50 (semver)
Unaffected: 1.0.50 (semver)
Create a notification for this product.
Date Public
2026-10-09 00:00
Credits
Leseratte10
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110112",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-17T00:40:11.889327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-17T00:40:21.467Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/Finsys/dockhand",
          "product": "dockhand",
          "repo": "https://github.com/Finsys/dockhand",
          "vendor": "Finsys",
          "versions": [
            {
              "lessThan": "1.0.50",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.0.50",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Leseratte10"
        }
      ],
      "datePublic": "2026-10-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T19:05:27.234Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-h4vc-h76x-c279)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-h4vc-h76x-c279"
        },
        {
          "name": "VulnCheck Advisory: Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.50-oidc-privilege-escalation-via-missing-token-claim-validation"
        }
      ],
      "title": "Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110112",
    "datePublished": "2026-10-13T19:05:27.234Z",
    "dateReserved": "2026-10-13T16:22:43.401Z",
    "dateUpdated": "2026-10-17T00:40:21.467Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109587 (GCVE-0-2026-109587)

Vulnerability from cvelistv5 – Published: 2026-10-16 17:08 – Updated: 2026-10-16 17:16
VLAI
Title
Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel
Summary
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call. To remediate this issue, users should upgrade to version V11.3.2 or later.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE
  • CWE-863 - Incorrect authorization
Assigner
AMZN CNA under the mitre root
CNA scorecard A 94/100 over 139 records in the last 180 days details
References
Impacted products
Vendor Product Version
FreeRTOS FreeRTOS-Kernel Affected: 11.3.0 , ≤ 11.3.1 (custom)
    cpe:2.3:a:freertos:freertos-kernel:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Ada Logics Ltd Anthropic
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRTOS-Kernel",
          "vendor": "FreeRTOS",
          "versions": [
            {
              "lessThanOrEqual": "11.3.1",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freertos:freertos-kernel:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "11.3.1",
                  "versionStartIncluding": "11.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ada Logics Ltd"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to version V11.3.2 or later.\u003c/p\u003e"
            }
          ],
          "value": "Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.\n\n\n\nTo remediate this issue, users should upgrade to version V11.3.2 or later."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T17:16:01.447Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.2"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-138-aws/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-pv9j-rq42-3fjc"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-109587",
    "datePublished": "2026-10-16T17:08:07.685Z",
    "dateReserved": "2026-10-12T20:09:13.779Z",
    "dateUpdated": "2026-10-16T17:16:01.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109561 (GCVE-0-2026-109561)

Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-12 20:55
VLAI
Title
goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations
Summary
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6476 records in the last 180 days details
References
Impacted products
Vendor Product Version
aaif-goose goose Affected: 1.28.0 , < 1.44.0 (semver)
Unaffected: 1.44.0 (semver)
Create a notification for this product.
Date Public
2026-07-17 00:00
Credits
Akıner Kısa Project Loupe
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "goose",
          "repo": "https://github.com/aaif-goose/goose",
          "vendor": "aaif-goose",
          "versions": [
            {
              "lessThan": "1.44.0",
              "status": "affected",
              "version": "1.28.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.44.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ak\u0131ner K\u0131sa"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Project Loupe"
        }
      ],
      "datePublic": "2026-07-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user\u0027s selected approval mode in PermissionInspector::inspect."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T20:55:15.574Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Pull Request #10528",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/aaif-goose/goose/pull/10528"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/aaif-goose/goose/commit/b0f4e2a0f1a5507aa0a0fbe73d0b5c77a3e86845"
        },
        {
          "name": "Vulnerable code in permission_inspector.rs",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/aaif-goose/goose/blob/v1.43.0/crates/goose/src/permission/permission_inspector.rs#L159"
        },
        {
          "name": "goose v1.44.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/aaif-goose/goose/releases/tag/v1.44.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/aaif-goose/goose"
        },
        {
          "name": "VulnCheck Advisory: goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/goose-from-1.28.0-before-1.44.0-manual-approval-bypass-via-read-only-tool-annotations"
        }
      ],
      "title": "goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109561",
    "datePublished": "2026-10-12T20:55:15.574Z",
    "dateReserved": "2026-10-12T19:27:51.947Z",
    "dateUpdated": "2026-10-12T20:55:15.574Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109560 (GCVE-0-2026-109560)

Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-13 15:39
VLAI
Title
Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining
Summary
Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.
Severity
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:38 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6476 records in the last 180 days details
References
Impacted products
Vendor Product Version
continuedev continue Affected: 0 , ≤ 1.5.47 (semver)
    cpe:2.3:a:continue:continue:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-09-17 00:00
Credits
Akıner Kısa Tardfyou
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109560",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:38:38.730434Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T15:39:07.306Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/continuedev/continue/issues/13288"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40continuedev/cli",
          "product": "continue",
          "repo": "https://github.com/continuedev/continue",
          "vendor": "continuedev",
          "versions": [
            {
              "lessThanOrEqual": "1.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:continue:continue:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.5.47",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ak\u0131ner K\u0131sa"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tardfyou"
        }
      ],
      "datePublic": "2026-09-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, \u0026\u0026 or | to execute code as the user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T20:55:14.911Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #13288",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/continuedev/continue/issues/13288"
        },
        {
          "name": "Vulnerable code in permissionChecker.ts",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/continuedev/continue/blob/d3f60ba9dd3fb5bfd3c91d6fbb41ce1aa768db45/extensions/cli/src/permissions/permissionChecker.ts#L162-L174"
        },
        {
          "name": "Vulnerable code in policyWriter.ts",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/continuedev/continue/blob/d3f60ba9dd3fb5bfd3c91d6fbb41ce1aa768db45/extensions/cli/src/permissions/policyWriter.ts#L18-L31"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/continuedev/continue"
        },
        {
          "name": "VulnCheck Advisory: Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/continue-cli-through-1.5.47-bash-permission-rule-bypass-via-command-chaining"
        }
      ],
      "title": "Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109560",
    "datePublished": "2026-10-12T20:55:14.911Z",
    "dateReserved": "2026-10-12T19:27:51.634Z",
    "dateUpdated": "2026-10-13T15:39:07.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109559 (GCVE-0-2026-109559)

Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-13 16:52
VLAI
Title
EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate
Summary
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
Severity
8.4 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
8.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:48 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6476 records in the last 180 days details
References
Impacted products
Vendor Product Version
tianma-if EdgeEver Affected: 1.6.26 , ≤ 1.112.0 (semver)
Create a notification for this product.
Date Public
2026-10-12 00:00
Credits
wgetnz
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109559",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:48:42.127249Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:52:15.376Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/tianma-if/edgeever",
          "product": "EdgeEver",
          "repo": "https://github.com/tianma-if/edgeever",
          "vendor": "tianma-if",
          "versions": [
            {
              "lessThanOrEqual": "1.112.0",
              "status": "affected",
              "version": "1.6.26",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "wgetnz"
        }
      ],
      "datePublic": "2026-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T20:55:14.269Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #536",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/tianma-if/edgeever/issues/536"
        },
        {
          "name": "GitHub Issue #546",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/tianma-if/edgeever/issues/546"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca"
        },
        {
          "name": "Vulnerable code in index.mjs",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/desktop/src/main/index.mjs#L1560-L1564"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/tianma-if/edgeever"
        },
        {
          "name": "VulnCheck Advisory: EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/edgeever-desktop-1.6.26-through-1.112.0-navigation-allowlist-bypass-via-will-navigate"
        }
      ],
      "title": "EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109559",
    "datePublished": "2026-10-12T20:55:14.269Z",
    "dateReserved": "2026-10-12T19:27:51.341Z",
    "dateUpdated": "2026-10-13T16:52:15.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109525 (GCVE-0-2026-109525)

Vulnerability from cvelistv5 – Published: 2026-10-13 15:15 – Updated: 2026-10-13 15:24
VLAI
Title
girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
Summary
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
7.3 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:24 UTC
CWE
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3899 records in the last 180 days details
References
Impacted products
Vendor Product Version
girishsaraf Online-Appointment-Booking-System Affected: f427b4757128ca253d33d0cc4e87bbb9c999a4d5
    cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
huimouwaner (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109525",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:24:06.182543Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T15:24:17.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "submit2 Handler"
          ],
          "product": "Online-Appointment-Booking-System",
          "vendor": "girishsaraf",
          "versions": [
            {
              "status": "affected",
              "version": "f427b4757128ca253d33d0cc4e87bbb9c999a4d5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "huimouwaner (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T15:15:17.321Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-417189 | girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/417189"
        },
        {
          "name": "VDB-417189 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/417189/cti"
        },
        {
          "name": "CVE-2026-109525 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-109525"
        },
        {
          "name": "Submit #984343 | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/984343"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/15"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-12T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-12T21:09:51.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-109525",
    "datePublished": "2026-10-13T15:15:17.321Z",
    "dateReserved": "2026-10-12T19:04:30.719Z",
    "dateUpdated": "2026-10-13T15:24:17.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109524 (GCVE-0-2026-109524)

Vulnerability from cvelistv5 – Published: 2026-10-13 15:00 – Updated: 2026-10-15 15:12
VLAI
Title
girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
Summary
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 14:52 UTC
CWE
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3899 records in the last 180 days details
References
Impacted products
Vendor Product Version
girishsaraf Online-Appointment-Booking-System Affected: f427b4757128ca253d33d0cc4e87bbb9c999a4d5
    cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
a86402175 (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109524",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:52:18.164707Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:12:14.182Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Admin Display Pages"
          ],
          "product": "Online-Appointment-Booking-System",
          "vendor": "girishsaraf",
          "versions": [
            {
              "status": "affected",
              "version": "f427b4757128ca253d33d0cc4e87bbb9c999a4d5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "a86402175 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T15:00:14.312Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-417188 | girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/417188"
        },
        {
          "name": "VDB-417188 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/417188/cti"
        },
        {
          "name": "CVE-2026-109524 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-109524"
        },
        {
          "name": "Submit #984342 | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/984342"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/14"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-12T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-12T21:09:47.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-109524",
    "datePublished": "2026-10-13T15:00:14.312Z",
    "dateReserved": "2026-10-12T19:04:25.647Z",
    "dateUpdated": "2026-10-15T15:12:14.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list